cleancloud/deploy/cloudformation/cleancloud-role.yaml at main · cleancloud-io/cleancloud · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
AWSTemplateFormatVersion: "2010-09-09"
Description: >
  CleanCloud read-only IAM role for cross-account scanning.
  Deploy to each spoke account via StackSets or manually.
  https://github.com/cleancloud-io/cleancloud

Parameters:
  HubAccountId:
    Type: String
    Description: AWS account ID where CleanCloud runs (the hub/scanner account).
    AllowedPattern: "^[0-9]{12}$"
    ConstraintDescription: Must be a 12-digit AWS account ID.

  RoleName:
    Type: String
    Default: CleanCloudReadOnlyRole
    Description: Name of the IAM role to create. Must match --role-name flag in CleanCloud.

  ExternalId:
    Type: String
    Default: ""
    Description: >
      Optional. If set, the hub account must provide this value when assuming the role
      (confused deputy protection). Pass the same value via --external-id in CleanCloud.

  EnableAIScan:
    Type: String
    Default: "false"
    AllowedValues: ["true", "false"]
    Description: >
      Set to true to attach the AI/ML policy (Bedrock Provisioned Throughput, SageMaker endpoints/notebooks/Studio apps/training jobs/processing jobs, EC2 GPU).
      Required for: cleancloud scan --category ai
      See: security/aws/ai-readonly.json

Conditions:
  UseExternalId: !Not [!Equals [!Ref ExternalId, ""]]
  EnableAIScan: !Equals [!Ref EnableAIScan, "true"]

Resources:
  CleanCloudRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${HubAccountId}:root"
            Action: sts:AssumeRole
            Condition: !If
              - UseExternalId
              - StringEquals:
                  "sts:ExternalId": !Ref ExternalId
              - !Ref AWS::NoValue
      Policies:
        - PolicyName: CleanCloudReadOnly
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: EC2ReadOnly
                Effect: Allow
                Action:
                  - ec2:DescribeVolumes
                  - ec2:DescribeSnapshots
                  - ec2:DescribeSnapshotAttribute
                  - ec2:DescribeImages
                  - ec2:DescribeAddresses
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DescribeNatGateways
                  - ec2:DescribeRegions
                  - ec2:DescribeInstances
                  - ec2:DescribeSecurityGroups
                Resource: "*"
              - Sid: ELBReadOnly
                Effect: Allow
                Action:
                  - elasticloadbalancing:DescribeLoadBalancers
                  - elasticloadbalancing:DescribeTargetGroups
                  - elasticloadbalancing:DescribeTargetHealth
                Resource: "*"
              - Sid: RDSReadOnly
                Effect: Allow
                Action:
                  - rds:DescribeDBInstances
                  - rds:DescribeDBSnapshots
                  - rds:DescribeDBSnapshotAttributes
                Resource: "*"
              - Sid: RedshiftReadOnly
                Effect: Allow
                Action:
                  - redshift:DescribeClusters
                Resource: "*"
              - Sid: OpenSearchReadOnly
                Effect: Allow
                Action:
                  - es:ListDomainNames
                  - es:DescribeDomain
                Resource: "*"
              - Sid: CloudTrailReadOnly
                Effect: Allow
                Action:
                  - cloudtrail:LookupEvents
                Resource: "*"
              - Sid: CloudWatchReadOnly
                Effect: Allow
                Action:
                  - logs:DescribeLogGroups
                  - cloudwatch:GetMetricStatistics
                Resource: "*"
              - Sid: S3ReadOnly
                Effect: Allow
                Action:
                  - s3:ListAllMyBuckets
                  - s3:GetBucketTagging
                Resource: "*"
              - Sid: STSIdentity
                Effect: Allow
                Action:
                  - sts:GetCallerIdentity
                Resource: "*"
      Tags:
        - Key: ManagedBy
          Value: CleanCloud
        - Key: Purpose
          Value: CrossAccountReadOnlyScanning

  CleanCloudAIPolicy:
    Type: AWS::IAM::Policy
    Condition: EnableAIScan
    Properties:
      PolicyName: CleanCloudAIReadOnly
      Roles:
        - !Ref CleanCloudRole
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: BedrockReadOnly
            Effect: Allow
            Action:
              - bedrock:ListProvisionedModelThroughputs
            Resource: "*"
          - Sid: SageMakerReadOnly
            Effect: Allow
            Action:
              - sagemaker:ListEndpoints
              - sagemaker:DescribeEndpoint
              - sagemaker:DescribeEndpointConfig
              - sagemaker:ListNotebookInstances
              - sagemaker:DescribeNotebookInstance
              - sagemaker:ListDomains
              - sagemaker:DescribeDomain
              - sagemaker:ListApps
              - sagemaker:DescribeApp
              - sagemaker:ListTrainingJobs
              - sagemaker:DescribeTrainingJob
              - sagemaker:ListProcessingJobs
              - sagemaker:DescribeProcessingJob
            Resource: "*"
          - Sid: EC2GPUReadOnly
            Effect: Allow
            Action:
              - ec2:DescribeInstances
            Resource: "*"
          - Sid: CloudWatchGPUMetrics
            Effect: Allow
            Action:
              - cloudwatch:GetMetricStatistics
              - cloudwatch:ListMetrics
            Resource: "*"

Outputs:
  RoleArn:
    Description: ARN of the CleanCloud IAM role.
    Value: !GetAtt CleanCloudRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-RoleArn"

  RoleName:
    Description: Name of the CleanCloud IAM role.
    Value: !Ref CleanCloudRole